Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2023, 12:49

General

  • Target

    935b7414ca34e1edff0bc5fe57fec5da1167016d66436f0c7a4bf2e5c75716db.exe

  • Size

    340KB

  • MD5

    65077df1536185fd541f9e111933bbe5

  • SHA1

    dbb50490bb1c733bc9af1bd08fac6e335071b076

  • SHA256

    935b7414ca34e1edff0bc5fe57fec5da1167016d66436f0c7a4bf2e5c75716db

  • SHA512

    2e6903285074a05cdac633025e2b87f6af395f054399ae87923e338279040b16977b68d75e067dcbc4b46e3e6cf286502376b92f9bf67633c5f5e1106d75a15b

  • SSDEEP

    6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H

Malware Config

Extracted

Family

redline

Botnet

24.01

C2

37.220.86.164:29170

Attributes
  • auth_value

    1c7f0aa21138601b5201a3a4a0123991

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\935b7414ca34e1edff0bc5fe57fec5da1167016d66436f0c7a4bf2e5c75716db.exe
    "C:\Users\Admin\AppData\Local\Temp\935b7414ca34e1edff0bc5fe57fec5da1167016d66436f0c7a4bf2e5c75716db.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4804-132-0x00000000000F0000-0x000000000014A000-memory.dmp

    Filesize

    360KB

  • memory/4804-133-0x0000000005280000-0x0000000005898000-memory.dmp

    Filesize

    6.1MB

  • memory/4804-134-0x0000000004D70000-0x0000000004E7A000-memory.dmp

    Filesize

    1.0MB

  • memory/4804-135-0x0000000004B00000-0x0000000004B12000-memory.dmp

    Filesize

    72KB

  • memory/4804-136-0x0000000004CA0000-0x0000000004CDC000-memory.dmp

    Filesize

    240KB

  • memory/4804-137-0x0000000004FB0000-0x0000000005042000-memory.dmp

    Filesize

    584KB

  • memory/4804-138-0x0000000006340000-0x00000000068E4000-memory.dmp

    Filesize

    5.6MB

  • memory/4804-139-0x0000000005050000-0x00000000050B6000-memory.dmp

    Filesize

    408KB

  • memory/4804-140-0x0000000008540000-0x0000000008702000-memory.dmp

    Filesize

    1.8MB

  • memory/4804-141-0x00000000091E0000-0x000000000970C000-memory.dmp

    Filesize

    5.2MB

  • memory/4804-142-0x0000000006070000-0x00000000060E6000-memory.dmp

    Filesize

    472KB

  • memory/4804-143-0x00000000060F0000-0x0000000006140000-memory.dmp

    Filesize

    320KB